Malicious PDF — malware analysis report

Static analysis result for SHA-256 822c9034f2b0b772…

MALICIOUS

PDF

73.3 KB Created: 2020-11-26 00:45:45 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-07
MD5: 90a8bcf1ed4188b5d9bf9271c23a0f33 SHA-1: bbf92c799ac22e35aab7213e75deaadb2e536d53 SHA-256: 822c9034f2b0b772822a2ebad51c567bcc28d8f71296c7b7a04bf03ae512ac73
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a URL that mimics a search result for a game download, likely intended to trick the user into clicking it. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as a phishing or trojan PDF. No scripts were extracted, but the embedded URI is the primary indicator of a phishing lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffnew.ru/strik?utm_term=descargar+halo+the+fall+of+reach+en+espa%25C3%25B1ol+pdf PDF link annotation
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/b0c1898b-8ab7-4259-9891-6f0bdb02c546/59590794664.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5d57bff2-7298-403f-9907-9a7795e8ed39/mathematics_a_discrete_introduction.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dddee4d1-0751-49ca-af75-69bb39f23f3e/gajesaxefupefunujodug.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/499f0ce1-9145-4045-a47a-7e7c3bc8c836/jabazuzok.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/24e8cf64-64ef-4062-9ad8-e6d9f6ef599a/bexexevifurunadil.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a7c10cc2-d256-4f41-a215-7f47ff0f0836/76609275109.pdfIn PDF document text
    • https://s3.amazonaws.com/fipijife/microsoft_word_printing_labels_template.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a4556d6e-8faa-472e-8390-406a262f1e1e/words_that_start_with_ame.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/174c64ea-dfb2-4bbb-80f3-06f0bff1b1db/kegugowuwafoxigoxepada.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7c6fd4a7-1b76-4cbb-bfdc-6785410cf554/86759208156.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/90720c19-ebb4-4818-a959-bdf93bca825f/9077580283.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d1aa.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD1AA 5368 bytes
SHA-256: bd6edb83c920254b10d22d75a24dceb1ffd4dd5e0d9eb51abfca8b660bfaf8c6
font_01_sfnt_off0000e3a1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE3A1 10660 bytes
SHA-256: 7f41a3b50083dba1c7a028a426060244bb96dcca9625ccea0393ff93c9254a1b
font_02_sfnt_off000107d9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x107D9 4324 bytes
SHA-256: 05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176

Open this report in the interactive analyzer, or submit your own file for analysis.